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EXECUTIVE OFFICE OF THE PRESIDEN’ ox 
OFFICE OF M\BXGEMENT AND BUDGET 
DATE: AUG 8 1975 ; WASHINGTON, Oc. 20503 
REPLY TO 
ATTN OF; SD 


SuRIRET: Implementation of the Privacy Act of 1974 
- Agency Privacy Liaison Representatives 


Attached for your information are several documents 
which may be helpful to your efforts to implement 
the Privacy Act of 1974. 

° Two recent opinions rendered by the Department of Justice 
on the relationship of the Privacy Act to the Freedom 

of Information Act and several other statutes. 


° a series of documents pertaining to implementation of 
the Privacy Act by OMB. 
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Derury Assisranr A Bey CHEN! 
OFFick aF LEGAL, COUNSEL 
Department of dlustice 
a BM. 20530 


JUL 16 1975 


Mr. Robert P. Bedell 

Assistant General Counsel 
Office of Management and Budget 
Washington, D. C. 20503 


Dear Bob: 


This is im response to. your request for informal 
_ views concerning the relationship of the confidentiality 
provisions of the Railroad Retirement Act to the Privacy 
Act of 1974. 


er Recognizing the impossibilit of reconciling the 

seek | Et yo 

ue Privacy Act of 1974 with any other law, we offer the follow- 
ing observations. 


The secess provisions of the Privacy Act, 5 USC 552a(d) 
deal with an individual's access to records concerning him- 
self.. The Act expresses little concern for the privacy of 
third party sources of information. The relevant provisions 
of the Railroad Retirement laws, on the other hand, deal 
with the confidentiality of certain types of information - 
regardless of who seeks it. The Privacy Act is later in 
time and more specific as to the individual access, The 
Railroad Retirement laws, while earlier in time, deal more 
specifically with certain information but not with individ- 
ual access to medical information. 


Under the circumstances, the normal rules of statutory 
construction are of little help: (1) The Privacy Act as 
Later in time prevails; (2) repeals of earlier acts by 
implication are not favored and the Railroad Retirement 
laws prevail; (3) dealing with individual access the Privacy 
Act is more specific and therefore prevails; (A) dealing 
with only Railroad Retirement records and being more specific, 
those laws prevail. It is a typical Privacy Act peabien: 
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Assuming the law to be insoluble, I would suggest 
that the safer course is to follow the Privacy Act while 
taking full advantage of 5 USC 552a(£)(3). It may serve 
the same purpose as the Railroad Retirement law (45 USC 362) 
and is less likely to produce Litigation. 


I wish the Railroad Retirement Board good luck in 
any case. : 


Sincerely, , 
PS PP vd. we 
BOE st : fo SA Sa 
Laces “ ON Re ee 
Pe ene oe ae 


i gposle' 
_” Mary -G. Lawton 
Deputy Assistant Attorney General 
Office of Legal Counsel 


gh Ot 
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Meade Whitaker, isq. 

Chieé Counsel JUL3 2 i975 
Internal Revenue Sexvice 
Washington, D.C. 20224 


Dear Mx. Whitaker: 


in a letter dated April 14, ‘1975, Harold <,. Flamayzan, 
Breeton of your Disclosure Division, i aaah oui ylews 
as to whether the Privacy Act. of 1974, PL. 93-572, is the 
vers 1 oxelusive avenue available to. = ‘Individual ine sees 
whe TET novernment cecords about himsel*, ox whether the Freedom 


- tnformation Ack vould Blao be available for this purpose. 


x 


Tag 


A 


Neither the Literal Language ok the tro Acca nor their 
een histories provide a clear unswer to this sues~ 
tion, The Freedom of Information Act provides thet 
emt reeorda are svallable to ‘any person’ 
unless thay fir into one vf nine exempt cat 
cuae the agency may, but need mot, refuse 
Pyiwacy Act authorizes "an individual”? to reo 
ak morrection of those 
L 


enue 23 es er 
Ks SSIES oer 


agories, in wivlen 
isel 


dae Sates) ent 
SC LOSUure. LO8 


pertaining to himself and see 


subject to two generakh and se even specific exemptions, The 
Preedom of Information Act, having been passed and anended 
first, makes no reference to the Seay Act. The Privacy 
Act makes only two direst references to the Freedom of 
Toformation Act. New section.5 0.$.0. 532a(b) (QQ) vermita 
Giselosure. cf records about an Individual without ale prier 
consenk LE disclosure would be required py the Yreedom of 


informazion Ach«e Siwhsection (4) of the same section sr 
that an agency may net use a Freedow of information Act 
exemption to deny an individual access to files aSaue Fema 
that would be available wader the Privacy Act. ho mention 
is made o£ the possibility thar an individual might senk 
reeprds under beth Acts. 
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It should be noted that an earlier version of the 
privacy bills did address this question. Section 205%b) 
H.R. 16373, as it passed the Senate on Noven ber 22, 1974, 


specified: 


Nothing in this Act shall be constxcued to permit 
the withholding of any personal information which is 
otharwise required to be disclosed by Law or any 
reguiation thereunder. " 


inis language would have assured that information available 
under the Freedom of Information Act would continue to be 
avyailaole, to the individual as well as to third parties, 
despite aay broader exemption in the Privacy Act. ‘The 
omission of this language from the finak enactment sucbests 
that Congress ultimately decided that the Privacy Act 
exemotions should govern exclusively, although the omission 
iS not explained in the legislative history of the version 
that £ilmally passed. oy 

Since no cleax reason is given for thea omission of this 
languase in the legislative history, Lt wight be argued that 


QO 


the two Acts were nevertheless Incended to provikie alteraake 
or duplicate remadies for an individuel who seas aceress ta 


xecords about himself. In our view, however, a veading of 
the two Acts as 4 whole and consideration of their practical 
application leads to a contrary conciusion, namely, that 

the Privacy Act is the exclusive remedy for an individual 
who seeks records about himself contaimed in a system of 
racords cover ed by the Privacy Act. 


ot 


yet i 


mexe would be no diffieuliy in harmonizing application 
of the cwo Acts to the same request if the effect of the 
Privany Ack were merely to expand access whieh the FOT Ack 
alceady provides, Then o one might 3 reasonably assert thar a 
LBs 


rwas Eree to proceed under the older ae 
¢ could obtain still more by proceeding under t 
is true thet im most respects the Privacy A 
4 
Do 


Ct 
by the person seekince Ata oe mon ge gy se 
a LAR PRS A ae Rud chiles Ow Pecmioxrs 


te 
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Aisitations upon AgCtass, payond whak the FOr Act would 
autnorize. For example, under tne FOL Act an Agency could 
provide personal flles to a person sores mo pe theix 
subject without requiring him to produ solid proof of 
his identity; subsection (£)(2) of the Sppteae Act, however, 
authorizes the establishment of verifleation procedures. 
Similarly, under the FOL Aet an agency would not be able 
to withnold medical information from its subject ee 
pbeeguse it determined that disclosure would be harmful 
him; whereas subsection (£)€3) of the Privacy Act ser 
ar agency to restrict certain disclosures to the requesting 
Bubject s physiclan rather than making them to the subject: 
himsel€. Finally, mention might be made of the Privacy Act's 
pronibition on access to information compiled in snticipation 
o£ a Civil proceeding. Subseetion (d)(5). Tt is settee 
implausible that such substantial protections as these were 
latended only to apply to che Incremental access which the 
Vrivacy Act provides beyond that of the FOL Act -- so that 
they could be entirely avoided Lf the FOE Act alone were 
ae basis of the request. Et seems clear t 
nacted as desirable provisions in and of eee cone 
Coe as iere Limitations upon the relatively small broadening 
oc aecess achieved by the Privacy Act. Ik they are to bea 
given such Independent efiect, they must be held as Coe 
to all requests by Eile subjects and not 
the Privacy Act rather than the FOI Act. 


Another substantial obstacle to the oe. ch, 


at tae FOL 
Act and the Privacy Act afford alternative foras of procedures 
is the fact that neither Act requires the requester to 


dentLlfy the statutory vrovisions under which h 3 
8 made -~ and im fact many (if not most} current F 
‘do not contain such identification. Withour sveec 
it. would be impossible to determine which Act o va 
request xelied upon; and it is utterly implausible 
Congress intended substantial effects to attach a 
to a Code citation, but to an executive ox judicial surmise 
concerning which cltetion the requester would have used if 
he had used one. 


Cort ine 
wont 
0) 
er Pd 
ies) 
a) 


e} 
ty 
A, 


§ 
ry 
> 


LOL merely 


Concurrent Anplication 


en Ne NN peony 


Of course the foregoing objections could be overcome 
r 


4 


the Privacy Act were to be considered not inmerely an eltern 


; 
es ae 
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to the FOL Act but a supplement to it «= that is, 1£ both 
the FOL Act and the Privacy Act were to be considered appli- . 
cable simultaneously to all requests by file subjects. Other 
provisions make it clear, however, that the two acts simply 
cannot be xead entirely together. 


_ For example, the Privacy Act, while preseribing tine 
limits for the correction of Yecords, prescribes no limits 
on the agency decision to grant or deny access to records, | 
the FOL Act, on the other hand, sets rigid Limits on the 
decision to grant or deny access. 1/ Furthermore, the FOL 
Act provides that no exhaustion of administrative remedies 
is required if its time limits are not met; the Privacy 
Act, being silent on the subject, presumably requires 
exhaustion of administrative remedies. 2/ The FOR Act requires 
motice, upon denial of access to records, that the indtariduak 
may appeal that decision within the agency. The Privacy Act 
requires nelther the intermal appeal itself nor any aotice 
o£ further riehts after denial. 3/ A party denied records 
undex the FOL Act may obtain injunctive rellef and costs 
and attorneys fees; no speeifle statute of limitations is 
provided, Similar relief is available under the Privacy — 
Act but there is a two-year statute of iimltations. 4/ 


O£ course one might maintain that the two Acts were 
weant to be evmulative where not Inconsistent, but where 
ineonsistent the provisions of the Later Act would prevail. 
Such an interpretation is cast into doubt by subsection (q) 
of the Privacy Aer which specifically states chat the FOT Act 
exemptions from diselosure cannot be used te deny an individ-~ 
ual access to files about himself. ‘There would be no need for 


i/ Compare 5 U.S.C. 552a(d) (1) with 2 U.S.C. 552(a) (6). 
2/ Compare 5 U.S.C. no2ta) (6) (C) with 5 ULS.c. 5452a(d) (1). 
3/ Compare 5 U.S.C, 552(a) (6) (A) (4) with 5 U.S.c, 552a(d) (1). 


4f Compare 5 U.S.C, 552(a) (4) with 5 U.S8.c. S52a(2) (5). 
we Lym 
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cha provision Lf elt ineonsiste entles between the two 
Recs ware to be resolved in Favor of tha 


eee to xead the two acts as cumulative, at 
jeast in part, creates a scheme of enormous Sues, 
Lf they are to be read as complementa oy except whe e 
inconsistent, it becomes nereess sary to determine shen that 
inconsistency cinted For example, is the Privacy Act 
PROVLSLON permitting special disclosure tesirierions on 


medieal records -- limiting disclesure to a physician ~— 
consistent with the FOL provision on diselosure? Dees 


(U.3.C. Sa2a(q) mean not only that the (b)(5) exenption 
of FOT camot be used ss a basis for denying records tut 
also Chat the (b)(3) exemption for statutory cestrietions 
on disclosure is umavaila able? 6/ Goes the fact that the 
fxivacy Act does not require an administrative a 20De 

x 


aeaet 
a denial of e885 overrule the FOL remtirement chat such 
en aopeal be. perry ami notice of its availabilicy be 
given the requester? Reading the acts cumlatively, when 
would the administrative remedies be oxhausted for purcoses 
o£ seeking judicial veview? If reeords are provided So the 


te 


3 
individual, what feas may ba charged? 7/ 


oacaetieaaatannel Lateah sak a erias ieee ee eat Ae CT 


= tags Merten ie 


rad hod ; 
Bf Of course, the provision is also somewhat Super 


“under the theory thet the Privac cy Ach is rae Wis 3a ae 
it seems to be less go. If a} intricate aystem were being 
established, whereby some provisions of the larer Act ~ 
sould supersede those of the ear} ler, but others would 
nee, one would expect more than a single exoression of 
AS 


the practical operation of such supersedure 3 

nena that the entire Privacy Act was xe ares Ba 
oxtlusive, subsection (q) can be seen as 4 TReWwNAt guver- 

Aucus but understandable affirmation of eine Lyity in 

a particularly important aren, : 


6/ Under the Vecerans Administration Aatieg Ys geo 
eecords are not nuvallable to the vate ee 
would be intuviouws to his physieal or eet healer} 
FOL, such records would be cxemst From discloany 
5 U.5.0. 552(b) (3) +- records exempt by statute. What 

ds thelr availabilicy under Privacy Act? 


@/ The POL Act permits fees to be charged for the costs of 
both search and duplication. 5 U.S.C. 552(a)(A). Under 

é P Aad eee 
Lie. P ris acy Ack ote Gupbication 3 fees ‘excluding search’ 


may be charred, 2ECE CS) 
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Courts and administrators should not be csst upon this > 
sea of uncertainty without a clear expression of congressional 
dutent to that effect. That dees not exist in the present 
case. To-the contrary, im our view the Privacy Act bears 
every evidence of having been regarded as a self-contained 
unit, embodying all requlremmts that Congress intended, 
from definitions to provisions of judicial review. It is, 
in our view, Intended to be exclusively applicable to all 
cases in which an individual requests records from a system 
of records covered by the Privacy Act, after tae date on 
which it comes into effect. : 


Sincerely, 


Mary C. Lawton 
Peputy Assistant Attorney General, 
Office of Legal Counsel 


reas ae 
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WASHINGTON, D.C. 20503 


August 7, 1975 


MEMORANDUM FOR ASSISTANT DIRECTORS, ASSOCIATE DIRECTORS AND 
DEPUTY ASSOCIATE DIRECTORS 


SUBJECT: Privacy Act of 1974 


As a result of the provisions of the Privacy Act of 1974, 
certain changes must be made in the maintenance of 


information on individuals within the Divisions and Offices: 


of OMB. The net effect of these changes is to place certain 
prohibitions on the type of records Inaintained hy the 
Divisions and offices in order to “to comply with those séGtions 
of the Act dealing with safeguards, unauthorized disclosure, 
youtine uses, etc. In order to secure the information 
contained in these records it will be necessary after 
September 27, 1975 to contact the offices, listed below. 
Requests to access these records will be handled in 
accordance with the Office's rules and regulations on 
individual privacy. The procedure for records disposition 
are as follows: 


1. Send to the Personnel Office: 


a. Resume's, SF i71's, etc. on applicants for 
employment with OMB. ; 


b. Files on employees containing such material as 
copies of employee evaluations, SF 50's, SF 52's, memoranda, 
etc. 

c. Employee Record Cards SF 7h. 

d. copies of evaluations of former employees. 

e. copies of training request for employees. 

2. Send to the Budget and Management Office: 
a. all copies of the time and attendance cards 


b. copies of travel Requests, vouchers, or give to each | 
employee. _ Fy te cee 
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c. Any other records dealing with travel, payroll, 
leave, etc. that contain information pertaining to an 
individual. 


3. Send to the Security Officer all notices of security 
clearances or determinations, including OMB Form 45, 


4, Send to Records Officer all copies of the OMB Staff 
Roster. 


The records listed above represent those identified by the 
Records Unit during its recent survey. It is possible, 
however, that there are a number of records on individuals 
being maintained that were not identified by the Records 
Unit. Division officials should be cautioned that the 
maintenance of such records may result in civil and griminal 
penalties. 
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Of” ce Memorandum No. 76-2 
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AUGUSTE 75.41 975 


OFFICE OF MANAGEMENT AND BUDGET 


TO OFFICE OF MANAGEMENT AND BUDGET STAFF 


SUBJECT: Restrictions on use of computers for processing 
personal data 


The Privacy Act of 1974 (P.L. 93-579, 5 U.S.C. 552a) establishes 
a number of requirements governing Federal agency personal 
record-keeping practices. This memorandum establishes 

policies and responsibilities for implementing the require- 
ments of the Act in regard to: 


° maintenance of personal data by OMB staff on the OMB 
computer, other agency computers or commercial computer 
time~sharing services, and 


° use of the OMB computer for pereonat data by other 
agencies. 


Except as otherwise noted, the provisions of this memorandum 
are effective September 27, 1975. 


1. OMB personnel shall not maintain any individually 
identifiable data on any computer unless 


a. a positive determination has been made that the 
system of records is not ‘subject to the provisions 
‘of the Act, or 


b. a system notice consistent with the provisions of 
5 U.S.C. 552a(e) (4) has been published in the 
Federal Register, and "appropriate administrative, 
technical, and physical safeguards to insure the 
security and confidentiality of records and to 
protect against any anticipated threats or hazards 
to their security or integrity which would result 
in substantial harm, embarrassment, inconvenience, 
or unfairness to any individual on whom information 
is maintained" (5 U.S.C. 552a(e)(1)) have been 
established, 


Written justification to substantiate a determination 
that a system of records is not subject to the Act 

shall be developed by the office or division ee 
for the system of records and submitted to the Assistant 
to the Director for Administration for review, Oe Fa 
tion and approval. 
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System notices consistent with the provisions of 

5 U.S.C. 552a(e) (4) shall be prepared and coordinated 
in accordance with procedures established by the 
Assistant to the Director for Administration. 


The office or division responsible for maintaining the 
system of records shall be responsible for develoving 
and documenting requirements for safeguarding data 
consistent with the provisions of 5 U.S.C. 552a(e) in 
coordination with the Assistant to the Director for 
Administration and the Deputy Associate Director for 
Information Systems. 


‘2. The OMB computer shall not be used for processing any | 

individually identifiable data for other agencies unless 

the using agency has ‘ 

a. provided certification that the system of records 
is not subject to the Act, 

loge provided evidence that it has published all rules, 
notices and otherwise met all requirements of the 
Privacy Act, and 


c. the data safeguard requirements to be met by the 
OMB computer center have been documented and 
concurred in by the Deputy Associate Director for 
Information Systems. 


3. Minimum standards for maintaining any individual ly 
identifiable data on the OMB computer and rules of 
conduct for persons involved in the design, development, 
operation or maintenance of personal data systems on 
the OMB computer shall be established by the Deputy 

. Associate Director for Information Systems by 
PMGUST. O15 2975s ‘ 


4, All interagency computer sharing agreements to which 

, OMB is a party and all contracts for computer services 
shall include privacy safeguard peeNts ions concurred 
in by the Assistant to the Director for Administration, 
the General Counsel and the Deputy Associate Director 
for Information Systems. All current agreements or 
contracts shall be amended to provide such vrovisions 
prior to September 27, 1975. 


>. The Deputy Associate Director for Information Systems 
shali take necessary steps to remove all data files 
from the OMB Computer which do not meet the policies 

ang criteria established herein by September 27, 21975. 
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OMB PROPOSED RULES FOR IMPLEMENTING THE ACT 


Notice is hereby given that the Office of Management and 
Budget (sometimes hereinafter referred to as OMB) is 
considering promulgating Chapter III, Part 1302 of Title 5, 
Code of Federal Regulations. The proposed regulations 
implement the provisions of section 5 U.S.C. 552a(£), Public 
Law 93-579 of December 31, 1974 (the Privacy Act of 1974) 
(88 Stat, 1896). 


Interested persons are invited to submit written comments, 
suggestions, or objections regarding these proposed rules to 
the Assistant to the Director for Administration, Office of 
Management and Budget, Washington, D.C. 20503. All relevent 
material received efore September 12, 1975 will be 
considered. All written comments received will be 
available, ‘upon request, for public inspection at the above 
address only between the hours of 9:00 a.m. and 5:3 pl. 
fonday through Friday (excluding legal Federal holidays), 
during the 30-day period described above, and for 10 days 
thereafter. 


Section 1302 is proposed as follows: 


1302.1. Rules for determining if an individual is the 
subject “Of a “récord. individuals desiring to know if a 
Specific system of records maintained by the Office of 
Management and Budget contains a record pertaining to them 
should address their inquiries to the Assistant to the 
Director for Administration, Office of Management and 
Budget, Washington, D.C. 20503. The written inquiry should 
contain a specific reference to ‘the system of records 
maintained by OMB listed in the OMB Notices of Systems of 
Records or it should describe the type of record in 
sufficient detail to reasonably identify the system of 
records. Notice of OMB systems of records subject to the 
Privacy Act will be made in the Federal Register and copies 
o£ the notices will be available upon request to the 


Assistant to the Director for Administration when SO 
published, A compilation of such notices will also be made 
and published by the Office of Federal Register, in 


accordance with section 5 U.S.C. 552a(£). 


At a minimum, the request should also contain sufficient 
identifying information to allow OMB to determine Af there 
is a record pertaining to the individual making the request 
in a particular system of records. In instance when the 
identification is insufficient to insure disclosure 
individual to whom the information pertains in view of the 
sensitivity of the information, OMS reserves the right to 
solicit from the requester additional identifying 
infoxmation. 


. 
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Oxdinarily the requester will be informed whether the named 
system of records contains a record pertaining to the 
requester within 10 days of receipt of such a request 
(excluding Saturdays, Sundays, and legal Federal holidays). 
Such a response will also contain or reference the 
procedures which must be followed by the individual making 
the request in oxder to gain access to the record, 


Whenever a Yxesponse cannot be made within the 10 days, the 
Assistant to the Director for Administration will inform the 
requester of the reasons for the delay and the date by which 
a response may be anticipated, , 


1302.2. Requests for Access. 


a. Requirement for written requests. Individuals 
desiring “to gain access to a xécord pertaining to them in a 
system of records maintained by OMB must submit their 
request in writing in accordance with the procedures set 
forth in paragraph b, below. Due to security measures in 

£fect in both the Old and New Executive Office Buildings, 
requests made .in person (walk-ins) cannot be accepted, 
except that individuals who are employed by the Office of 
Management and Budget may make their request on a regularly 
scheculed workday (Monday through Friday, excluding legal 
Federal holidays) between the hours of 9:00 a.m. and 5:30 
p.m. Such requests for access by individuals employed by 
OMB need not be made in writing. 


b. Procedures. 


atom nar ies 


(1) Content of the Request. The request for acvess 
to a record in a system OF récords shall be addressed to the 
Assistant to the Director for Administration, at the address 
cited above, and shall name the system of records or contain 
a description (as concise as possible) of such system of 
recoxds. the xequest should state that the request is 
pursuant to the Privacy Act of 1974. In the absence of such 
a statement, if the request is for a record pertaining to 
the requester maintained by OMB in a system of records, the 
request will be presumed to be made under the Privacy Act of 
1974, The request should contain necessary information to 
verify the identity of the requester (see paragraph b(2) (f), 
below). In addition, the requester should include any other 
information which may assist in the rapid identification of 
the record for which access is being requested (e.g., maiden 
neme, dates of employment, etc.) as well as any other 
identifying information contained in and reguired by the OMB 
Notice of Systems of Records, 
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If the request for access follows a prior request under 
section 1302.1, above, the same identifying information need 
not be included in the request for access if a reference is 
made to that prior correspondence, or a copy of the OMB 
resoonse to that request is attached. 


<£ the individual specifically desires a copy of the record, 
the request should so specify. See section 1302.4, below. 


(2) OMB action on request. A request for access 
will ordinarily be answered within 10 days, except when the 
Assistant to the Director for Administration determines 
otherwise, in which case the reguester will be informed of 
the reason for the delay and an estimated date by which the 
request will be answered, When the request can be answered 
within 10 days, it shall include the following: : 


(a) A statement that there is a record as 
reguested or a statement that there is not a record in the 
system of records maintained by OMB; 


(b) a statement as to whether access will be 
granted only by providing a copy of the record through the 
mail: or the address of the location and the date and time 
at which the record may be examined. In the event the 
requester is unable to meet the specified date and time, 
alternative arrangements may be made with the official 
specified in 2b(1) above; 


(c) a statement, when appropriate, that 
examination in person will be the sole means of granting 


access only when the Assistant to the Director fox 
Administration has determined that it would not unduly 
liapede the requester's right of access. 


(d) the amount of fees charged, if any (see 


section 1302.4 and 1302.7 below) (Fees are applicable only to 
requests for copies.); 


(e) the name, title, and telephone number of 
the OMB official having operational control over the record; 
and 


(£) the documentation required by OMB to 
verify: the identity of the requester. At a minimum, OMB's 
verification standards include the following: 


(1) Current or former OMB Env loyees. 

Ro ee renee mene Sener ons ore ye ee perio week non Sregmulaner gabedane 

Current ox former OMB employees requesting access to a 
record pertaining to them in a system of records maintained 


by OMB may, in addition to the other requirements of this 
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section, and at the sole discretion of the official having 
operational control over the record, have his or her 
identify verified by visual observation. If the current or 
former OMB employee cannot be so identified by the official 
having operational control over the records, identification 
documentation will be required. Employee identification 
cards, annuitant identification, driver licenses, or the 
"employee copy" of any official personnel document in the 
record are examples of acceptable identification validation. 


(2) Other than current or former OMB 
employees. Individuals other than current or former OMB 
employees requesting access to a record pertaining to them 
in a system of records maintained by OMB must produce 
identification documentation of the type described in 
2(£)(1), above, prior to being granted access. The extent 
of the identification documentation required will depend on 
the type of record to be accessed. In most cases, 
identification verification will be accomplished by the 
presentation of two forms of identification. Any additional 
requirements will be specified in the system. notices 
published pursuant to 5 U.S.C. 552a(e) (4). 


(3) Access granted by mail, For records 
to be accessed by mall, the Assistant (5° the Director for 
Administration shall, to the extent possible, establish 
identity by a comparison of signatures in situations where 
the data in the record is not so sensitive that unauthorized 
access could cause harm or embarrassment to the individual 
to whom they pertain. No identification documentation will 
be required for the disclosure to the requester of 
information required to be made available to the public by 5 
Ursa, “S525 When, in the opinion of the Assistant to the 
Director for Administration, the granting of access through 
the mail could reasonably be expected to result in harm or 
embarrassment if disclosed to .a person other than the 
individual to whom the record pertains, a notarized 
tatement of identity or some similar assurance of identity 
will be required. ; 


(4) Unavailability of identification 


et s,m Hroeceecsetearenivnrs rive beeen: ene 


oh chad aaan nel If an individual is “Unable Roe produce 


Pegs to sign a statement minster eer area and 
acknowledging that knowingly or willfully seeking or 
obtaining access to records about another person under false 


pretenses may result in a fine of up to $5,000. In 
adgition, depending upon the sensitivity of the records 
sought to be accessed, the official having operational 


control over the records may require such further reasonable 


assurances as ma be considered . 
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wy. 


statements of other individuals who can attest to she 
identity of the requester. 


(5) Access by the parent of a minor, OF 


| edetsmesuce ge suena , oe 
Legal guardian. A parent of “a minor, upon presenting 
Suitable personal identificati on, May access on bohalf of 


the minor any record pertaining to the minor maintained by 
OMB in a system of records. A legal guardian may similarly 
act. on behalf of an individual declared to be incompetent 
due to physical - or mental incapacity or age by a court of 


competent jurisdiction, upon the Sp ema ah ef) “ons 
documents authorizing the legal guardian to so act and vpon 


suitable personal identifica ation of the guardian. 


(6) Granting access when accompanied by 
phates eee | ee 
another individual. When an “Individual requesting access to 


his “Yer record in a system of records maintained by OMB 
oe ciiee- ‘to be accompanied by another individual during the 
course of the sige ga of the record, the individual 


making the request shall submit to the official having 
operational control of the record, a signed statement 
authorizing that person access to the recoxG. 


(7) of access for inadequate 
P See pea iach — acme 
identification documen accion. tt. toe <OLELC? having 
Sil echoes ent eden a ann us 
Operation coutrol over the records in a system of reco Ores 
maintained by OMB determines that an individual. seel 
access has not provided sufficient i@entification 


documentation to pexmit access, the Ofer Lal 
with the Assistant to the Director for Adminis 
to finally denying the individual access. 


shall consuit 
Sion. prior 


rn oad 
cr 
% 
A) 


(g) Medical records. The records 
of records which are medical records shall be 2 
the individual to whom they pertain in such menner and 
following such procedures as the Assistant to the D3 Lxector 
for Administration shall direct, When OMB, ain consultation 
with a physician, determines that the disclosure of medical 
information could have an adverse effect upon the individual 
to whom it pertains, OMB may transmit such information to a 
physician named by the individual. 


(h) Exceptions. Nothing in this section shall 

crema terse irene pciabameceiee 5 ’ ‘os . 
be construed to entitle an individual the rigne to access: to 
any information compiled in reas sonable anticipation te 


civil action ox proceedings. 


1302.3. Acccs to the accounting of ciScloseres ea 
records. Ruea= “governing the granting Of access to Ene 


accounting of disclosures are the same as those for step 


Approved For Release 2003/08/20 : CIA-RDP84-00933R00030024001 2-2 


Approved For Release 2003/08/20 : CIA-RDP84-00933R000300240012-2 


access to the records (including verification of identity) 
outlined in section 1302.2, above. 


1302.4. Requests for copies of records, Rules governing 
requests for copies of records are the same as those for the 
granting of access to the records (including verification of 
identity) outlined in section 1302.2, above. (See also 


section 1302.7 for rules regarding fees.) 


1302.5. Requests to ‘Amend Records. 


vtec 


a. Requirement Lor written requests. Individuals 
desiring to amend a record that pertain to them in a system 
of records maintained by OMB, must submit their request in 
writing in accordance with the procedures set forth herein 
unless this requirement is waived by the official having 
responsibility for the system of records. Records not 
subject to the Privacy Act of 1974 will not be amended in 
accordance with these provisions, however, individuals who 
believe that such records are inaccurate may bring this to 
the attention of OMB. 


pce. Ee OCee ees 

(1) {a} The request to amend a record in a system 
of records shall be addressed to the Assistant to the 
Director for Administration, Included in the request shall 
be the name of the system and a brief description of the 
record proposed for amendment. In the event the request to 
amend the record is the result of the individual's having 
gained access to the record jin accordance with the 
provisions concerning access to records as set forth above, 
copies of previous correspondence between the requester and 
OMB will serve in lieu of a separate description of the 
record. 


(b) When the individual's identity has been 
previously verified pursuant to section 1302.2{2) (£) herein, 
further verification oe identity is not required as long as 
the communication doe not ‘suggest that a need Or 
verification has odeeee ee If the individual's identity 
has not been previously verified, OMB may require 
identification validation as described in section 
1302 2255 (2) €F).5 Individuals esiring assistance in the 
preparation of a request to amend a record should contact 
the Assistant to the Director for Administration ‘at the 
address cited above, 


(c) “he exact portion -of the record the 
andividual seeks to have amended should be clearly 
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should also be set forth, or at a minimum, the facts which 
the individual believes are not accurate, relevant, timely, 
or complete should be set forth with such particularity as 
to permit OMB not only to understand the individual's basis 
for the request, but also to make an appropriate amendment 
to the record. 


(d) The request must also set £orth the 
reasons why the individual believes his record is not 
accurate, relevant, timely, or complete. In oxder to avoid 
the retention by OMB of personal information merely to 
permit verification of records, the burden of persuading OMB 
to amend a xrecord will be upon the individual. The 
individual must furnish sufficient facts to persuade the 


official in charge of the system of the inaccuracy, 


irrelevancy, timeliness, or incompleteness of the record. 


(2) OMB action on the request. To the extent 
possible, a decision upon a réquest” to amend a record will 
be made within 10 days, excluding Saturdays, Sundays, and 
legal Federal holidays. ‘In the event a decision cannot be 
made within this time frame, the individual making the 
request will be informed within 10 days of the expected date 
for a @ecision. ‘he decision upon a request for amendment 
will include the following: 


(a) The decision of the Office of Management 
and Budget whether to grant in whole, or deny any part of 
the request to amend the record. 


(b) The reasons for the determination for any 
portion of the request which is denied. 


(c) The name and address of the official with 
whom an appeal of the denial may be Lodged. 


(a) The name and address of ° the official 
designated to assist, as necessary, and upon request of, the 
individual making the request in the preparation of the 
appeal. 


(e) A description of the review of the appeal 
within -OMB (see section 1302.6 below). 


(fF) A deseription of any other procedures 
which may be required of the individual in order to process 
the appeal. 


1302.6. Request for review. Individuals wishing to request 


. acca re Privaaertrat aaciees Rieckred . . 2 . 
a review of the decision by OMB with regard to an initial 
request to amend a record in accordance with the provisions 
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of section 1302.5 above, should submit the request for 
review in writing and, to the extent possible, include: the 
information specified in subsection a, below. Individuals 
desiring assistance in the preparation of their request for 


review should contact the Assistant to the Director for 
Administration at the address provided herein, 


a. ‘The reguest for review should contain a brief 
description of the record involved or in lieu thereof, 
copies of the correspondence from OMB in which the request 
to amend was denied and also the reasons why the requester 
believes that the disputed information should be amended. 
The request for review should make reference to the 
information furnished by the individual in Support o£ “his 
claim and the reasons as required by section 1302.5 above 
set forth by OMB in its decision denying the amendment, 
Appeals filed without a complete statement by the requester 
setting forth the reasons for the review will, of course, be 
processed. Nowever, in order to make the appellate process’ 
aS Meaningful as possible, the reguester's disagreement 
should be understandably set forth. In order to avoid the 
“unnecessary retention of personal information, OMB reserves 
the right to dispose of the material concerning the request 
to amend a record if no request for review in accordance 
with this section is received by OMB within 180 days of the 
mailing by OMB of its decision upon an initial request. A 
request for review received after the 180 Gay period may, at 
the discretion of the Assistant to the Director for 
Administration, be treated as an initial request to amend a 
record, 


b, The request for review should be addressed to the’ 
Assistant to the Director for Administration, 


c. Upon receipt of a request for review, the Assistant 
to the Director for Administration will convene a review 
group composed of the Assistant to the Director EOr 
Administration, the General Counsel, or their designees, and 
the official having operational control over the record. 
This group will review the basis for the requested review 
and will develop a recommended course of action to the 
Office's Committee on Freedom of Information and Privacy 
(hereinafter referred to as the Committee), If at any time 
additional information is required from the requester, the 
Assistant to the Director for Administration is authorized 
to acquire it or authorize its acquisition from the 
requester, 
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d. ‘The Committee is composed of: 
(1) Deputy Director 
(2) Assistant to the Director for Administration 
(3) General Counsel 
(4) Assistant Director for Budget Review 
(5) Assistant Director for Legislative Reference 


(6) Assistant to the Director for Public AfLaiLxrs 


(7) Deputy Associate Director for Information 
Systems 

(8) Deputy Associate Director fox Statistical 
Policy 


(9) Deputy Associate Director for National Security 
(10) Budget and Management Officer 
(11) Personnel Officer 


e. The Committee will review the request for review and 
the recommended course of action and will recommend a 
decision on the request for review to the Deputy Director, 
who has the final authority regarding appeals. 


f. The Deputy Director will inform the requester in 
writing of the decision on the request for review within 30 
days (excluding Saturdays, Sundays, and legal public 
. holidays) from the date of receipt by OMB of the 
individual's request for review unless the Deputy Director 
extends the 30 day period for good cause. The extension and 
the reasons therefor will be sent by OMB to the requester 
within the initial 30 day period. Included in the notice of 
a decision being reviewed, if the decision does not grant in 
full the request for review, will be a description of the 
steps the individual may take to obtain judicial review of 
such a decision, and a statement that the individual may 
file a concise statement with OMB setting forth the 
jndividual's reasons for his disagreement with the decision 
upon the request for review. The Assistant to the Director 
for Administration has the authority to determine the 
"conciseness" of the statement, taking into account the 
scope of the disagreement and the complexity of the issues. 
Upon the filing of a propex concise statement by the 
individual, any subsequent disclosure of the information in 
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dispute will have the information in dispute clearly noted 
and a copy of the concise statement furnished, as well as a 
concise statement by OMB setting forth its reasons for not 
making the requested changes, if OMB chooses to file such a 
statement. A copy of the individual's statement, and if it 
chooses, OMB's statement will be sent to any prior 
transferee of the disputed information who is listed on the 
accounting required by 5 U.S.C. 552a(c). . 


1302.7. Schedule of fees. 


sae eemiatiaenie care TE ea el 


ae Prohibitions against charging fees. Individuals 


will not be chargéd for: 
(1) the search and review of the record, 


(2) any copies of the record produced as a 
necessary part of the process of making ihe record available 
for access, or : 


(3) any copies of the requested record when it has 
been determined that access can only be accomplished by - 
providing a copy of the record through the mail. 


b. Waiver, The Assistant to the Director for 
Administration may at no charge, provide copies of a record 
i£ it is determined the production of the copies is in the 
interest of the Government. 


c. Fee schedule and method of payment. Fees will be 
charged “as provided below except aS provided in subsections 
a and b above, 


(1) Duplication of records. Records will be 

duplicated at™ ‘arate of ST1lo per page for all copying of 4 
“pages or more. There is no charge for duplicating 3 or 
Fewer pages, 


(2) Where it is anticipated that the fees 
chargeable under this section Will amount to more than 
$25.00, the requester shall be promptly notified of the 
amount of the anticipated fee or such portion thereof as can 
readily be estimated. In instances where the estimated fees 
will greatly exceed $25.00, an advance deposit may be 
required. The notice or request for an advance deposit 
shall extend an offer to the requester to consult with 
Office personnel in order to reformulate the request in a 
mannex which will reduce the fees, yet still meet the needs 
of the requester, 
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(3) Fees must be paid in full prior to issuance of 
requested copies. In the event the requester is in arrears 
for previous requests copies will not be provided for any 
subsequent. request until the arrears have been paid in full. 


(4) Remittances shall be in the form either of a 
personal check or bank draft drawn on a bank in the United 
States, or a postal money order, Remittances shall be made 
payable to the order of the Treasury of the United States 
and mailed or delivered to the Assistant to the Director for 
Administration, Office of Management and Budget, Washington, 
Des. 20503, 


(5) A xeceipt for fees paid will be given upon | 
request, 
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